Veridact API Reference

Complete external API call inventory — function names, parameters, return types, timeouts, error shapes, and execution order. Extracted from source code · Updated 2026-05-07

Authentication

Two authentication schemes coexist — one for the portal (JWT cookies) and one for the Enterprise API (API key header).

Enterprise API — Key Management

Rate Limits: Enterprise — 1,000 req/mo · Professional — 250 req/mo · Starter Screening — no API access. Headers: ratelimit-limit, ratelimit-remaining, ratelimit-reset, x-request-id

Standard Response Envelope

// All /api/v1/* responses follow this shape
{
  "data": /* payload */,
  "meta": {
    "request_id": "uuid",
    "timestamp": "2026-05-07T18:00:00.000Z"
  }
}

Environment Variables

Timeout Configuration

Error Shapes

Agent-Level Error (all screening agents)

{
  "matches": [],           // or pep_matches / results — empty array
  "queried": false,
  "error": "agent_failed"  // or the actual error message
}

API v1 HTTP Errors

Enterprise API — CDD Screening

{
  "id": "uuid",
  "status": "completed",
  "query": "Acme Corp",
  "risk_score": 42,
  "risk_level": "medium",  // low | medium | high | critical
  "sanctions_hits": 0,
  "pep_hits": 0,
  "adverse_media_hits": 3,
  "offshore_hits": 0,
  "screening_type": "CDD",
  "created_at": "2026-05-07T..."
}

Enterprise API — EDD Screening

{
  "sow_screening_id": "uuid-or-null",  // populated when include_sow=true
  "beneficial_ownership": { "chains": [], "ubo_found": false },
  "litigation": { "results": [], "sources_searched": 14 },
  "esg": { "level": "medium", "flags": [] }
}

Enterprise API — SOW Screening

Enterprise API — M&A Screening

Enterprise API — Retrieve & List

Person Background Check — 7-Phase Pipeline

Implemented in person-check-orchestrator.js. Entry point: runPersonCheck(subject, pool). Results stored in person_checks, person_check_sources, person_check_findings tables.

• 1
  Input Standardization

  Function: standardizeInputs(subject) → buildSearchUniverse(). Generates name variants (spelling map + nickname expansion), normalizes DOB to YYYY-MM-DD, extracts SSN-4 and location context. Outputs: nameVariants[], states[], dobYear, industryKey. No external calls.

  local only no API
• 2
  Identity Verification

  Function: runIdentityVerification(pool, personCheckId, subject, standardized). Queries OpenCorporates Officers API to cross-reference corporate registrations. Timeout: 10s via fetchUrl().

  OpenCorporates Officers GET api.opencorporates.com/v0.4/officers/search
• 3
  Criminal & Court Records

  Function: runCriminalPhase(pool, personCheckId, subject, standardized, universe). Runs all aliases through CourtListener. Also checks OFAC SDN via public API fallback. State court portals generated for all states in subject's location history.

  CourtListener v3 Dockets (PACER) CourtListener v4 Opinion Search OFAC SDN (public fallback) State Court Portals (10 states — manual URLs) County Court URLs (name pre-filled)
• 4
  Registry

  Sex offender registry (NSOPW + state portals), professional license databases (NPI, FINRA BrokerCheck, State Bar, FAA Airmen), Secretary of State corporate registries (30 states with direct officer-search URLs). All state-specific based on subject's location history.

  NSOPW (National Sex Offender Public Website) NPI Registry (healthcare) FINRA BrokerCheck State Bar Directories FAA Airmen Registry Secretary of State portals (30 states) PEPChecker.com
• 5
  Civil / Property

  Bankruptcy records (PACER/CourtListener bankruptcy search), civil judgment liens, property records via county assessor links. Generates manual search URLs for each state in subject's history.

  CourtListener Bankruptcy County Assessor Links (state-scoped)
• 6
  Media / Social

  Google News adverse media, Wikipedia cross-reference (disambiguation filter: requires both first AND last name in title/snippet, excludes disambiguation/sports pages), social media presence check. Also runs PEP/sanctions checks via PEPChecker and NameScan.

  Wikipedia API Google News RSS NameScan PEP+RCA+Adverse
• 7
  Corroboration + Confidence Scoring

  Function: calculateRiskScore(). Aggregates all findings with corroboration tags (name+DOB, name+location, name only). Generates final confidence level based on disambiguation context. Outputs risk_score (0–100), risk_level, confidence_level, and source audit trail in DB.

  local scoring no external calls

Person Check API Endpoints

CDD Pipeline — Execution Phases

Implemented in orchestrator.js as runCDDPipeline(query, entityType, jurisdiction, options). All agents run via Promise.all() — total time ≈ slowest agent.

Phase 0 — Entity Enrichment

Function: enrichEntity(query, { entityType, jurisdiction }). Companies only. Resolves canonical legal name, ticker, CIK, jurisdiction before any screening. Feeds improved entity identity to all downstream agents.

Phase 1 — Base Agents (all run in parallel)

Phase 1b — Essentials+ Additional Agents (parallel)

Phase 2 — Financial DD (all tiers, companies — runs after Phase 1)

Phase 3 — Professional+ Tier (parallel)

Phase 4 — Enterprise Only (parallel after Phase 3)

Phase 5 — Finalization (sequential, after all parallel phases)

Country risk assessment → assessCountryRisk(), risk scoring → calculateRiskScore(), adverse media consolidation (NameScan + OSINT + Adverse Media Engine merged into single array), data gap detection, AI summary generation → generateSummary(), verification → runVerificationAgent().

Agent: PEPChecker.com

{
  "pepList": [{ title, firstName, lastName, gender, aliases, function, specific, country, possibleBirthDates, active }],
  "sanctionList": [{ /* same shape */ }]
}

{
  "pep_matches": [{
    matched_name, match_score, category: "PEP"|"RCA",
    is_rca, active, role, function, country, risk_level, dob_confirmed,
    name_confirmed, confirmed, risk_pts
  }],
  "sanction_matches": [{ /* same fields + list, SANCTIONS category */ }],
  "pep_hits": 0, "sanction_hits": 0,
  "api_configured": true, "queried": true, "cache_hit": false,
  "error": null
}

Agent: OFAC SDN

{
  "apiKey": "...",
  "minScore": 80,
  "sources": ["SDN", "SSI", "NS-ISA", "FSE", "MBS", "CMIC", "GLOMAG", "NS-PLC", "UKRAINE-EO13662"],
  "cases": [{ "name": "...", "type": "individual"|"entity" }]
}

{
  "matches": [{ matched_name, match_score, lists, list_name, program, severity, reason, entity_type, uid, risk_pts: 15 }],
  "api_configured": true, "queried": true, "error": null
}

Agent: OpenSanctions

POST https://api.opensanctions.org/match/sanctions
{ "queries": { "q0": { "schema": "Person"|"LegalEntity", "properties": { "name": ["..."] } } } }

{
  "matches": [{ matched_name, score, category: "SANCTIONS"|"PEP"|"WATCHLIST",
    datasets, programs, reason, risk_pts, source_url }],
  "pep_hits": 0, "sanction_hits": 0
}

Agent: NameScan

{ "name": "John Smith" }

{
  "pep_matches": [{ matched_name, match_score, category, role, country, active, severity }],
  "adverse_media_hits": [{ title, url, published_date, source_label, category, sentiment, severity }],
  "pep_queried": true, "media_queried": true
}

Agent: Dilisense AML

Agent: UN Security Council Consolidated List

Agent: EU Financial Sanctions Files

Agent: UK HMT / OFSI Sanctions

Agent: OpenCorporates

{
  "companies": [{ name, company_number, jurisdiction_code, company_type, current_status, incorporation_date, registered_address }],
  "officers": [{ name, position, company.name, company.jurisdiction_code, opencorporates_url }],
  "risk_pts": 0
}

Agent: GLEIF LEI Registry

{
  "lei": "20-char-code", "entityName": "...",
  "status": "ACTIVE|INACTIVE", "jurisdiction": "US",
  "legalAddress": "...", "issuer": "...",
  "directChildren": [], "ultimateParent": null,
  "queried": true, "ran": true
}

Agent: UK Companies House

{
  "companies": [{ company_number, company_name, company_status, company_type, date_of_creation, registered_office_address }],
  "officers": [{ name, officer_role, appointed_on, resigned_on, nationality }],
  "psc_list": [{ name, kind, natures_of_control[], nationality, country_of_residence }],
  "risk_pts": 0
}

Agent: CourtListener / PACER

{ "results": [{ case_name, docket_number, court, date_filed, nature_of_suit, absolute_url }] }

Litigation Sources (14 total)

Implemented in veridact-litigation.js as searchLitigation(params). All 14 sources run in parallel via Promise.allSettled(). Total timeout: 20,000ms. Professional+ tier.

Normalized Record Schema (all 14 sources)

{
  source, type: "criminal"|"civil"|"regulatory"|"administrative"|"enforcement",
  caseName, caseNumber, court, dateFiled, dateResolved,
  status: "active"|"closed", outcome, penalty: 0,
  description, url, jurisdiction, parties: [], charges: []
}

Agent: Offshore Leaks (ICIJ)

Agent: OSINT Search Engine Intelligence

Agent: Financial Data Sources

Agent: Wayback Machine

GET https://archive.org/cdx/search/cdx?url={domain}&output=json&limit=10&fl=timestamp,statuscode,mimetype

Source of Wealth — 9-Source Verification Framework

Implemented in agents/sow-agent.js. Functions: runVerificationWorkflow(), assessRiskTier(), evaluateRedFlags(), validateAttestation(), getJurisdictionalRequirements(). PDF ID format: VDC-XXXXXXXX-SOW. Corroboration gauge: 0–100.

Webhooks

Delivered on screening completion. HMAC-SHA256 signed. Auto-disabled after ≥10 consecutive failures. 3-attempt backoff on delivery failure.

Webhook Payload Shape

{
  "event": "screening.completed",
  "screening_id": "uuid",
  "screening_type": "CDD"|"EDD"|"SOW"|"MA",
  "risk_score": 42,
  "risk_level": "medium",
  "sow_screening_id": "uuid-or-null",
  "completed_at": "2026-05-07T18:00:00.000Z"
}